fullshield 1.0.1 → 1.2.0

package/rules/SAST-LOGLEAK-001.md

@@ -0,0 +1,11 @@
+# SAST-LOGLEAK-001
+
+**Secret written to a log.** Experimental (`FULLSHIELD_EXPERIMENTAL_LOGLEAK=1`). CWE-532. Severity medium.
+
+`console`, winston, pino, bunyan, debug, or morgan logs `req.headers.authorization`, `req.headers.cookie`, the whole `req.body` on an auth route, or an identifier whose camelCase segments are `password`, `passwd`, `secret`, `token`, `apiKey`, or `authorization`. `tokenCount` is not a finding. A pino or winston `redact` list that covers the path clears that path. `req.body` on a non-auth route is not a finding.
+
+## Remediation
+
+Do not log credentials. Redact the path when the logger supports it.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 98.

package/rules/SAST-NEXT-001.md

@@ -0,0 +1,11 @@
+# SAST-NEXT-001
+
+**Server action writes without an auth check.** Experimental (`FULLSHIELD_EXPERIMENTAL_NEXT=1`). CWE-306. Severity medium. Confidence low.
+
+An exported `'use server'` function writes through a data sink and the file does not call `auth()`, `getServerSession`, `currentUser`, or `cookies()`.
+
+## Remediation
+
+Check the session inside the server action before writing.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 103.

package/rules/SAST-POSTMSG-001.md

@@ -0,0 +1,11 @@
+# SAST-POSTMSG-001
+
+**postMessage without an origin check.** Experimental (`FULLSHIELD_EXPERIMENTAL_BROWSER=1`). CWE-346. Severity medium.
+
+A `message` listener uses `event.data` and does not read `event.origin`. `postMessage` of a secret-named value with target `*` is the same rule.
+
+## Remediation
+
+Compare `event.origin` before using `event.data`, and pass a concrete target origin.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 101.

package/rules/SAST-REACT-001.md

@@ -0,0 +1,11 @@
+# SAST-REACT-001
+
+**Unsanitized HTML binding.** Experimental (`FULLSHIELD_EXPERIMENTAL_BROWSER=1`). CWE-79. Severity medium.
+
+`dangerouslySetInnerHTML` with a non-literal `__html`, Vue `v-html`, or Svelte `{@html}`, when the file does not mention DOMPurify or sanitize-html. A literal `__html` is not a finding. A server-side sanitize call in the same file clears it.
+
+## Remediation
+
+Sanitize the HTML with DOMPurify or sanitize-html before binding it.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 101.

package/rules/SAST-RSA-001.md

@@ -0,0 +1,11 @@
+# SAST-RSA-001
+
+**Weak key generation.** Experimental (`FULLSHIELD_EXPERIMENTAL_CRYPTO2=1`). CWE-326. Severity medium.
+
+`generateKeyPair('rsa', { modulusLength })` below 2048, or `ec` with a `secp192*` curve.
+
+## Remediation
+
+Use RSA 2048 or larger, or a modern curve.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 96.

package/rules/SAST-SESSION-002.md

@@ -0,0 +1,11 @@
+# SAST-SESSION-002
+
+**Session fixation on login.** Experimental (`FULLSHIELD_EXPERIMENTAL_SESSION2=1`). CWE-384. Severity medium.
+
+A login route writes `req.session.user`, `userId`, `uid`, or `auth*` without `req.session.regenerate` earlier in the file. `req.login` / `req.logIn` counts as regenerate only when the locked passport version is 0.6.0 or newer. An older passport is a finding that names that version.
+
+## Remediation
+
+Call `req.session.regenerate` before storing the user on the session.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 100.

package/rules/SAST-SSTI-001.md

@@ -0,0 +1,11 @@
+# SAST-SSTI-001
+
+**Server-side template injection.** Experimental (`FULLSHIELD_EXPERIMENTAL_SSTI=1`). CWE-1336. Severity critical.
+
+A tainted value is the template source for an engine listed in `models/ssti.json`. The data argument is not this rule. An engine that is not in the pack is not a finding.
+
+## Remediation
+
+Render a fixed template and pass user data as data, not as template source.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 97.

package/rules/SAST-TLS-001.md

@@ -0,0 +1,13 @@
+# SAST-TLS-001
+
+**TLS certificate verification disabled.** Experimental (`FULLSHIELD_EXPERIMENTAL_TLS=1`). CWE-295. Severity high.
+
+`rejectUnauthorized: false` or `checkServerIdentity` returning `undefined`, in options passed to `https.request` / `https.get`, `tls.connect`, `new https.Agent`, axios, undici `Agent({ connect })`, got, or `ssl` / `tls` options. A `ca` option on the same object is not a finding. An unresolved variable is not a finding.
+
+Files under `test/`, `__tests__/`, `*.test.*`, `*.spec.*`, or `scripts/dev*` are severity low with `context: "test"`. The same option inside `process.env.NODE_ENV !== 'production'` is severity medium.
+
+## Remediation
+
+Turn TLS verification back on. Do not ship `rejectUnauthorized: false`.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 95.

package/rules/SAST-TLS-002.md

@@ -0,0 +1,13 @@
+# SAST-TLS-002
+
+**NODE_TLS_REJECT_UNAUTHORIZED disabled.** Experimental (`FULLSHIELD_EXPERIMENTAL_TLS=1`). CWE-295. Severity high.
+
+`process.env.NODE_TLS_REJECT_UNAUTHORIZED` set to `0` in source, or the same variable set to 0 in a `Dockerfile` `ENV`, `package.json` scripts, a compose `environment` entry, or a committed `.env*` file.
+
+Test paths are severity low. A `NODE_ENV !== 'production'` guard in source is severity medium.
+
+## Remediation
+
+Turn TLS verification back on. Do not set `NODE_TLS_REJECT_UNAUTHORIZED=0`.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 95.

package/rules/SAST-TOKENSTORE-001.md

@@ -0,0 +1,11 @@
+# SAST-TOKENSTORE-001
+
+**Token written to localStorage.** Experimental (`FULLSHIELD_EXPERIMENTAL_BROWSER=1`). CWE-922. Severity low.
+
+`localStorage.setItem` whose key name contains `token`, `jwt`, or `accessToken`.
+
+## Remediation
+
+Keep tokens in memory or an httpOnly cookie, not in localStorage.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 101.

package/rules/SAST-WEBHOOK-001.md

@@ -0,0 +1,11 @@
+# SAST-WEBHOOK-001
+
+**Webhook without a verifier.** Experimental (`FULLSHIELD_EXPERIMENTAL_WEBHOOK=1`). CWE-345. Severity high.
+
+A handler reads a provider listed in `models/webhooks.json` (Stripe, GitHub, Slack, Shopify, Twilio) and the file never calls that provider's verifier. An unknown provider is not a finding. A signature compared with `===` stays `SAST-TIMING-001`.
+
+## Remediation
+
+Verify the provider signature before using the event.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 99.

package/rules/SECRET-FILE-002.md

@@ -0,0 +1,11 @@
+# SECRET-FILE-002
+
+**npm credential in `.npmrc`.** Experimental (`FULLSHIELD_EXPERIMENTAL_CREDFILES=1`). CWE-798.
+
+A literal `_authToken=` or `_auth=` value. `${...}` interpolation is not a finding.
+
+## Remediation
+
+Rotate this credential immediately, then load it from an environment variable or a secret manager. Removing it from the code is not enough: it remains visible in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §7.2 and Section 46 phase 105.

package/rules/SECRET-FILE-003.md

@@ -0,0 +1,11 @@
+# SECRET-FILE-003
+
+**Docker registry credential in `config.json`.** Experimental (`FULLSHIELD_EXPERIMENTAL_CREDFILES=1`). CWE-798.
+
+`config.json` (including `.docker/config.json`) that contains `auths` and a non-empty `auth` value.
+
+## Remediation
+
+Rotate this credential immediately, then load it from an environment variable or a secret manager. Removing it from the code is not enough: it remains visible in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §7.2 and Section 46 phase 105.

package/rules/SECRET-FILE-004.md

@@ -0,0 +1,11 @@
+# SECRET-FILE-004
+
+**kubeconfig credential.** Experimental (`FULLSHIELD_EXPERIMENTAL_CREDFILES=1`). CWE-798.
+
+A file with `apiVersion: v1` and `kind: Config` that also has a `token:` or `client-key-data:` value.
+
+## Remediation
+
+Rotate this credential immediately, then load it from an environment variable or a secret manager. Removing it from the code is not enough: it remains visible in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §7.2 and Section 46 phase 105.

package/rules/SECRET-FILE-005.md

@@ -0,0 +1,11 @@
+# SECRET-FILE-005
+
+**Committed Terraform state.** Experimental (`FULLSHIELD_EXPERIMENTAL_CREDFILES=1`). CWE-312. Severity high.
+
+Any `*.tfstate` or `*.tfstate.backup` file. State holds secrets.
+
+## Remediation
+
+Rotate this credential immediately, then load it from an environment variable or a secret manager. Removing it from the code is not enough: it remains visible in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §7.2 and Section 46 phase 105.

package/rules/SECRET-FILE-006.md

@@ -0,0 +1,11 @@
+# SECRET-FILE-006
+
+**Cloud service-account key.** Experimental (`FULLSHIELD_EXPERIMENTAL_CREDFILES=1`). CWE-798.
+
+JSON with `"type": "service_account"` and a non-empty `"private_key"`.
+
+## Remediation
+
+Rotate this credential immediately, then load it from an environment variable or a secret manager. Removing it from the code is not enough: it remains visible in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §7.2 and Section 46 phase 105.

package/rules/SECRET-FILE-007.md

@@ -0,0 +1,11 @@
+# SECRET-FILE-007
+
+**Committed private key file.** Experimental (`FULLSHIELD_EXPERIMENTAL_CREDFILES=1`). CWE-321.
+
+`id_rsa`, `id_ed25519`, `*.p12`, `*.pfx`, or `*.keystore`. A `.pub` file is not a finding. A PEM private key may also match `SECRET-PRIVKEY-001`.
+
+## Remediation
+
+Rotate this credential immediately, then load it from an environment variable or a secret manager. Removing it from the code is not enough: it remains visible in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §7.2 and Section 46 phase 105.

package/rules/SECRET-NEXTPUB-001.md

@@ -0,0 +1,11 @@
+# SECRET-NEXTPUB-001
+
+**Public env name looks like a secret.** Experimental (`FULLSHIELD_EXPERIMENTAL_NEXT=1`). CWE-798. Severity high.
+
+A `NEXT_PUBLIC_` name contains `SECRET`, `PRIVATE`, or `KEY`, unless the name contains `PUBLISHABLE`.
+
+## Remediation
+
+Rename the variable so the secret is not shipped to the client.
+
+See `SECURITY_SCANNER_SPEC.md` Section 46 phase 103.